Using The Certutil Utility - Sun Microsystems GlassFish Enterprise Server 2.1 Administration Manual

Using the certutil Utility

Before running certutil, make sure that LD_LIBRARY_PATH points to the location of the
libraries required for this utility to run. This location can be identified from the value of
AS_NSS_LIB in asenv.conf (product wide configuration file).
The certificate database tool, certutil, is an NSS command-line utility that can create and
modify the Netscape Communicator cert8.db and key3.db database files. It can also list,
generate, modify, or delete certificates within the cert8.db file and create or change the
password, generate new public and private key pairs, display the contents of the key database, or
delete key pairs within the key3.db file.
The key and certificate management process generally begins with creating keys in the key
database, then generating and managing certificates in the certificate database. The following
document discusses certificate and key database management with NSS, including the syntax
for the certutil utility:
http://www.mozilla.org/projects/security/pki/nss/tools/certutil.html.
Each of the items in the list below gives an example using NSS and JSSE security tools to create
and/or manage certificates.
Generate a self-signed server and client certificate. In this example, the CN must be of the
■
form hostname.domain.[com|org|net|...].
In this example, domain-dir/config. The serverseed.txt and clientseed.txt files can
contain any random text. This random text will be used for generating the key pair.
certutil -S -n $SERVER_CERT_NAME -x -t "u,u,u"
-s "CN=$HOSTNAME.$HOSTDOMAIN, OU=Java Software, O=Sun Microsystems Inc.,
L=Santa Clara, ST=CA, C=US"
-m 25001 -o $CERT_DB_DIR/Server.crt
-d $CERT_DB_DIR -f passfile <$CERT_UTIL_DIR/serverseed.txt
Generate the client certificate. This certificate is also a self-signed certificate.
certutil -S -n $CLIENT_CERT_NAME -x -t "u,u,u"
-s "CN=MyClient, OU=Java Software, O=Sun Microsystems Inc.,
L=Santa Clara, ST=CA, C=US"
-m 25002 -o $CERT_DB_DIR/Client.crt
-d $CERT_DB_DIR -f passfile <$CERT_UTIL_DIR/clientseed.txt
Verify the certificates generated in the previous bullet.
■
certutil -V -u V -n $SERVER_CERT_NAME -d $CERT_DB_DIR
certutil -V -u C -n $CLIENT_CERT_NAME -d $CERT_DB_DIR
Display available certificates.
■
certutil -L -d $CERT_DB_DIR
Chapter 9 • Configuring Security
Using Network Security Services (NSS) Tools
117